Efficient Zero-Knowledge Proof of Algebraic and Non-Algebraic Statements with Applications to Privacy Preserving Credentials

Transcription

1 Efficient Zero-Knowledge Proof of Algebraic and Non-Algebraic Statements with Applications to Privacy Preserving Credentials Melissa Chase 1, Chaya Ganesh 2, and Payman Mohassel 3 1 Microsoft Research, USA 2 Department of Computer Science, New York University 3 Visa Research, USA Abstract. Practical anonymous credential systems are generally built around sigma-protocol ZK proofs. This requires that credentials be based on specially formed signatures. Here we ask whether we can instead use a standard (say, RSA, or (EC)DSA) signature that includes formatting and hashing messages, as a credential, and still provide privacy. Existing techniques do not provide efficient solutions for proving knowledge of such a signature: On the one hand, ZK proofs based on garbled circuits (Jawurek et al. 2013) give efficient proofs for checking formatting of messages and evaluating hash functions. On the other hand they are expensive for checking algebraic relations such as RSA or discrete-log, which can be done efficiently with sigma protocols. We design new constructions obtaining the best of both worlds: combining the efficiency of the garbled circuit approach for non-algebraic statements and that of sigma protocols for algebraic ones. We then discuss how to use these as buildingblocks to construct privacy-preserving credential systems based on standard RSA and (EC)DSA signatures. Other applications of our techniques include anonymous credentials with more complex policies, the ability to efficiently switch between commitments (and signatures) in different groups, and secure two-party computation on committed/signed inputs. 1 Introduction Efficient proofs. Zero knowledge proofs [GMR85] provide an extremely powerful tool, which allows a prover to convince a verifier that a statement is true without revealing any further information. Moreover, it has been shown that every NP language has a zero knowledge proof system[gmw87], opening up the possibility for a vast range of privacy preserving applications. However, while this is true in theory, designing proof systems that are efficient enough to be used is significantly more challenging. In reality, we only have a few techniques for efficient proofs, and those only apply to a restricted set of languages. Almost exclusively, these proof systems focus on proving algebraic statements, i.e. statements about discrete logarithms, roots, or polynomial relationships between values [Sch90,GQ88,CS97b,GS08]. The most common and most efficient of these systems fall into a class known as sigma protocols. Of course we could express any NP relation as a

2 combination of algebraic statements, for example by expressing the relation as a circuit, and expressing each gate as an algebraic relation between input and output wires. But if we were to take this approach to prove a statement using sigma protocols we would need several exponentiations per gate in the circuit. This becomes prohibitively expensive for large circuits (for example a circuit computing a cryptographic hash function or block cipher). 4 Recently, [JKO13] introduced a new approach for proving statements phrased as boolean circuits, based on garbled circuits. Their construction has the advantage that it only requires a few symmetric key operations per gate, making it dramatically more efficient than a sigma-protocol-based solution for non-algebraic statements. This means that it is finally practical to prove statements about complex operations such as hash functions or block ciphers. For instance, zero knowledge proofs for an AES circuit or a SHA256 circuit can be done in miliseconds on standard PCs using state of the art implementations for garbled circuits. On the other hand, expressing many public key operations as a circuit is still extremely expensive. (Consider for example a circuit computing modular exponentiation on a cryptographic group - the result would be much larger than the circuit computing a hash function, and computing a garbled circuit for such a computation would be too expensive to be practical.) Now we have two very different techniques for achieving zero knowledge proofs for algebraic and non-algebraic statements. But in some applications, one is interested in proving statements that combine the two. For example, what if we want an efficient protocol for proving knowledge of a DSA or RSA signature, whose verification requires computing both a hash function and several exponentiations? The state of the art fails to take advantage of the best of both worlds and has to forgo the efficiency of one approach to obtain the other s. One might consider directly combining both protocols, but a naive solution would allow a cheating prover to use a different witness for the algebraic and non-algebraic components of the computation and produce a convincing proof for a statement for which there is no single valid witness. Thus, one of the basic challenges is to bind the values committed to in the sigma protocols to the prover s inputs in the GC-based zero knowledge proof, without having to perform expensive group operations (e.g. exponentiation) inside the garbled circuit, and without proving large-circuit statements using sigma protocols. Anonymous Credentials. Here, we primarily focus on the case of anonymous credentials, introduced by Chaum [Cha86], although we believe our results will be applicable to many other privacy protocols. A credential system allows a user to obtain credentials from an organization and at some later point prove to a verifier (either the same organization or some other party) that she has been given appropriate credentials. More specifically, the user s credentials will contain a set of attributes, and the verifier will require that the user prove that the attributes in his credential satisfy some policy. We say the system is anonymous if this proof does not reveal anything beyond this fact. 4 SNARKs [Gro10,GGPR13] allow for very efficient verification and short proofs, but have similar shortcomings in prover efficiency as the prover performs public-key operations proportional to the size of the arithmetic circuit representing the statement.

3 There have been several proposals for constructions of anonymous credential systems [CL01,CL04,BCKL08,Bra99,BL13]. In general, they all follow a similar approach: the credential is a signature from the organization on the user s attributes. To prove possession of valid credentials, the user will first commit to her attributes, then prove, in zero knowledge, knowledge of a signature on the committed attributes, and finally prove, again in zero knowledge, that the committed attributes satisfy the policy. To make these zero knowledge proofs efficient, most of the proposed credential systems are based on sigma protocols, which as described above give efficient proofs of knowledge for certain algebraic statements. This in turn means that the signatures used must be specially designed so that a sigma protocol can be used to prove knowledge of a signature on a committed message. 5 But what if we want to base our credentials on a standard signature such as FDH- RSA or DSA which includes hashing the message? Or what if we want the user to be able to prove a statement about his attributes that is not easily expressible as an algebraic relation? Our Results. We study the problem of combining proof systems for algebraic and nonalgebraic statements, and obtain the following results. Given an algebraic commitment C, we propose two protocols for proving that C is a commitment to x such that f(x) = 1 where f is expressed as a boolean circuit. Both constructions have the desired property that the GC-based component is dominated by the cost of garbling f (i.e. not garbling expensive group operations), and the total number of public-key operations is independent of the size of f. More specifically, our first solution has public key operations proportional to the maximum bit length of the input ( x ), and symmetric-key operations proportional to the number of gates in f. The second has public-key operations proportional to the statistical security parameter s and symmetric-key operations proportional to the number of gates in f + x s. Existing solutions either require public-key operations proportional to the size of f, or need to garble circuits for expensive group operations such as exponentiations in large groups. Building directly on these protocols, we show how to implement a proof that one committed message is the hash of another, and a proof that two commitments in different groups commit to the same value. Finally, we show how we can combine all of these protocols to obtain an efficient proof of knowledge of a signature on a committed message for RSA-FDH 6, DSA, and EC-DSA signatures. 5 Technically, [Bra99,BL13] work slightly differently in that the user and organization jointly compute the proof of knowledge of a signature as part of the credential issuance. However they still use a customized issuing protocol which would not be compatible with standardized signatures, and they use sigma protocols exactly as described here to prove that the committed attributes satisfy the policy. 6 This easily extends to standardized variants of RSA like RSA-PSS.

4 Applications. Anonymous Credentials based on RSA, DSA, EC-DSA signatures. The most direct application in the context of anonymous credentials would be to use RSA, DSA, or EC-DSA signatures directly as credentials but still allow for privacy preserving presentation protocols. This would be slower than existing credential systems, but it would have the advantage that the issuer would not have to perform a complex protocol, but would only have to issue standardized signatures. It further enables interoperability with existing libraries and non-private credential applications. 7 Alternatively, we could construct a service which allows users to convert their non-private credentials (based on RSA/DSA/EC-DSA signatures) into traditional anonymous credentials (e.g. Idemix [ide10] or UProve [PZ13] tokens, or keyedverification credentials[cmz14]). Using our new protocol, the service could perform that conversion without knowing the user s attributes: the user would commit to his attributes, prove using our protocol that they have been signed, and then obtain from the service an anonymous credential encoding the same attributes. (All of these anonymous credential systems allow for issuing credentials on committed attributes.) Anonymous Credentials with more general policies. Even if we consider a system based on traditional anonymous credentials, we might use the Π Com,f protocol (which we will describe in section 3) to allow the user to prove that his attributes satisfy a more complicated policy. For example, he might want to release the hash of one of his attributes and prove that that has been done correctly, or prove that an attribute has been encrypted using a standard encryption scheme like RSA-OAEP. Our protocols could also be used to prove that a user s attributes fall in a given range, or to prove statements about comparisons between attributes. If the range of values possible for each attribute is small, we already have reasonably efficient solutions - the user can just commit to each bit of the value, and do a straightforward proof. However this becomes expensive when the range gets larger, in which case the most efficient known approach is based on integer commitments [FO97] and requires several exponentiations with an RSA modulus where the exponent is larger than the group order (e.g. a roughly 2000 bit exponentiation with a 2000 bit modulus for reasonable security parameters). Alternatively we can use our second scheme, which only requires a number of public-key operations linear in the security parameter (e.g. 60), and allows those operations to use much more efficient elliptic curve groups. We note that the independent and concurrent work of [KKL + 16] provides an alternative solution to the problem of anonymous credentials for general policies, using different techniques. 7 Delignat-Lavaud et al [DLFKP16] achieve a similar result using SNARKs, but with very different tradeoffs: their approach results in much shorter, non-interactive proofs, but much more expensive proof generation. They also explore several applications in more detail; in some of these applications, those which allow for interactive proofs, our protocols could be used to achieve these different tradeoffs.

5 Converting between different commitment schemes. There are many protocols based around commitments, and ideally we would be able to combine these protocols arbitrarily. For example, if we have an efficient protocol for proving that a committed tag matches one of the attributes in a user s credential, and another protocol for proving that a committed tag is not on a list of revoked values, then we would be able to combine the two protocols to prove that the user s credential has not been revoked. However, often the protocols will be based on different commitment schemes, or even worse, on schemes that operate in different sized groups. (For example UProve credentials can be instantiated in standardized elliptic curve groups like those used for EC-DSA, while revocation systems like that in [Ngu05] require pairing groups; to combine the two we would need to find a pairing group whose group order matches one of the standardized curves. Finding a pairing group to match a specific group order often incurs a significant cost in efficiency.) With our protocol for converting between commitment schemes we could choose the most efficient groups for each, and then the user would merely prove that he has used the same attributes in each. Before our work, the only known approach to convert between groups of different sizes was to use integer commitments, which as described above can be quite expensive. Other privacy-preserving protocols. We note that while anonymous credentials make a good motivating application, these problems (converting between commitments schemes, comparing committed values, or proving other non-algebraic statements) come up in many other privacy/anonymity scenarios. 2PC with authenticated input. As input to a secure computation protocol, sometimes it is desirable to use previously committed [JS07] or signed [CZ09] inputs. In our constructions, we show how to commit to an input x and prove knowledge of x (or prove knowledge of a signature on x) and a non-algebraic statement f(x) = 1 using garbled circuits. As we discuss in section 3.4, it is relatively easy to extend our construction to also allow secure two-party computation of g(x, y) where x is the prover s input and y the verifier s, hence obtaining secure two-party computation on signed/committed inputs. The benefit of this approach is that checking the signature takes place outside the secure two-party computation and can be significantly more efficient. 2 Preliminaries 2.1 Simulation-based Security We use a simulation-based definition of security in the ideal/real world paradigm, which is formulated by specifying an ideal functionality. A protocol is secure if it emulates this ideal functionality in the presence of any adversary. Our definitions are in the standalone setting (as opposed to the UC framework). We formulate the simulation-based definitions by defining a functionality F in the ideal world. In the ideal world, all parties and the adversary A interact via F. Let IDEAL F,A (x 1, x 2 ) denote the output vector of the adversary and the honest party from the execution in the ideal world. In the real world, a protocol π is executed among the parties, and let REAL π,a (x 1, x 2 ) denote the output of the adversary and the honest party from the execution of π. A two party

6 protocol π securely realizes the functionality F if for any PPT adversary A in the real world, there exists a PPT adversary S in the ideal-world, such that {IDEAL F,S (x 1, x 2 )} x1,x 2s.t x 1 = x 2 c {REAL π,a (x 1, x 2 )} x1,x 2s.t x 1 = x 2 that is, the two distributions are computationally indistinguishable. 2.2 Commitment Scheme A commitment protocol involves two parties: the committer and the receiver. At a high level, it consists of two stages, a commitment phase and a de-commitment phase. In the commitment stage, the committer with a secret input m engages in a protocol with the receiver. At the end of this protocol, receiver does not know what m is (hiding property), and at the same time, the committer, can subsequently in the de-commitment phase, open only one possible value of m (binding property). Throughout the paper, we use algebraic commitment schemes that allow proving linear relationships among committed values. An example of such a scheme with computational binding and unconditional hiding properties based on the discrete logarithm problem is the one due to Pedersen [Ped91]. It works in a group G of prime order q. Given two random generators g and h such that log g h is unknown, a value x Z q is committed to by choosing r randomly from Z q, and computing C x = g x h r. Protocols are known in literature to prove knowledge of a committed value, equality of two committed values, and so on, and the protocols can be combined in natural ways. In particular, Pedersen commitments allows proving linear relationships among committed values: Given C x and C y, prove that y = ax + b for some public values a and b. 2.3 Committing OT Similar to [JKO13] we need to need an OT protocol with a sender verifiability propertyi.e. that at the end of the OTs, the sender is committed to its messages, and can be asked to reveal all its input messages to the receiver. This is closely related to the notion of committing OT [KS06], but can be achieved even more generally since we do not require individual commitments to sender s messages. In particular, as discussed in [JKO13] it can be satisfied by a protocol where the sender commits to a seed in the beginning of the protocol, and then runs any secure OT protocol using the output of a pseudorandom generator on the seed as its random tape. Then the open phase can be realized by letting the sender reveal the seed and all the input messages. The ideal functionality F COT is defined in Figure 1. Fig. 1. The ideal functionality F COT The receiver inputs (choose, b), b {0, 1}, and the sender inputs (m 0, m 1). Output m b to the receiver. On input open from the sender, send (m 0, m 1) to the receiver.

7 2.4 Garbled Circuits We assume some familiarity with standard constructions of garbled circuits. We employ the abstraction of garbling schemes [BHR12] introduced by Bellare et al., but similar to [JKO13] we add a verification algorithm that can check correctness of the garbled circuit given all input labels to the circuit. A garbling scheme is defined by a tuple of algorithms G = (Gb, En, De, Eval, Ve) such that: Gb is a randomized garbled circuit generation function that takes a security parameter, and the description of a boolean circuit f and outputs a garbled circuit GC and the encoding and decoding information e and d, respectively. The En algorithm takes the encoding information e output by Gb, and an input x to f, and outputs the garbled input corresponding to x. The Eval algorithm takes the garbled circuit GC and the garbled input, and outputs an encoded output. The De algorithm gets the encoded output and the decoding information d as input and returns a decoded output. The Ve algorithm gets as input a garbled circuit GC, the encoding information e, and a boolean function f, and outputs d or. In our constructions, we assume that the encoding information e is a vector of pairs of input labels, where the pair (Ki 0, K1 i ) denotes the input labels for 0 and 1 for input wire i in the circuit. Similarly, we assume that the decoding information d is a vector of pairs of output labels. A garbling scheme may satisfy several properties such as correctness, authenticity and privacy. We review these notions next. Definition 1. A garbling scheme satisfies correctness if: for all boolean circuits f and all input x, De(d, Eval(GC, En(e, x))) = f(x) whenever (GC, e, d) Gb(f, 1 κ ) for all boolean circuits f and all (possibly malicious) garbled circuits GC and encoding information e, decoding information d, and all input x, if d Ve(GC, e, f) and d then De(d, Eval(GC, En(e, x))) = f(x) Definition 2. A garbling scheme has authenticity if for every circuit f, input x, and PPT algorithm A, the following probability Pr[ y f(x), y = De(d, d ) : (GC, e, d) Gb(f, 1 κ ), d A(GC, En(e, x))] is negligible in κ. Definition 3. A garbling scheme has privacy if there exists a PPT simulator S such that the following two distributions are indistinguishable: Real(f, x) : run (GC, e, d) Gb(f, 1 κ ), and output (GC, En(e, x), d). Ideal S (f, f(x)): output S(f, f(x))

8 2.5 Zero-knowledge Proofs A Zero-knowledge (ZK) proof allows a prover to convince a verifier of the validity of a statement, without revealing any other information. Let L be the language associated with an NP relation R: L = {x w : R(x, w) = 1}. A zero-knowledge proof for L lets the prover convince a verifier that x L for a common input x. A proof of knowledge captures not only the truth of a statement x L, but also that the prover possesses a witness w to this fact. A proof of knowledge for a relation R(, ) is an interactive protocol where a prover P convinces a verifier V that P knows a w such that R(x, y) = 1, where x is a common input to P and V. The prover can always successfully convince the verifier if indeed P knows such a w. Conversely, if P can convince the verifier with reasonably high probability, then it knows such a w, that is, such a w can be efficiently computed given x and the code of P. The formal definition follows. In the following, view V is the view of the verifier in the interaction, consisting of its input x, its random coins, and the sequence of the prover s messages. Definition 4 (ZK proof of knowledge). An interactive protocol P, V is a zero-knowledge proof of knowledge for an NP relation R if the following properties are satisfied. 1. Completeness: x, y such that R(x, y) = 1, Pr[ P (x, w), V (x) = 1] = 1 2. Proof of Knowledge: For every polynomial time prover strategy P, an oracle PPT machine K called the extractor such that K P (x) outputs w and Pr[ P (x, w), V (x) = 1 R(x, w ) = 0] is negligible in κ. 3. Zero-knowledge: For every polynomial time verifier V, there is a PPT algorithm S called the simulator such that for every x L, the following two distributions are indistinguishable: view V ( P (x, w), V (x) ) S(x) Honest-verifier zero-knowledge: An interactive proof system (P, V ) for a language L is said to be honest-verifier zero knowledge if there exists a PPT algorithm S called the simulator such that for all x L, view V ( P (x, w), V (x) ) and S(x) are indistinguishable. This definition says that the verifier gains no knowledge from the interaction, as long as it runs the prescribed algorithm V. If the verifier tries to gain some knowledge from its interaction with the prover by deviating from the prescribed protocol, we should consider an arbitrary (but efficient) cheating verifier V as in the property 3 of the above definition which is full zero-knowledge. Efficient zero knowledge proofs are known which are based on sigma protocols. Sigma protocols are three round public-coin protocols and are honest-verifier zero-knowledge proof systems. There exist sigma protocols for various tasks like proving knowledge of discrete logarithm of a value, that a tuple is of the Diffie-Hellman type etc., and it is also possible to efficiently combine sigma protocols to prove compound statements. It is

9 possible to efficiently compile a sigma protocol (which is honest-verifier ZK) into a zero-knowledge proof of knowledge. The Fiat-Shamir transform [FS86] converts any public-coin zero-knowledge proof into a zero-knowledge proof of knowledge and removes interaction, and is secure in the random oracle model [PS96]. Transformations in the common reference string model [Dam00,Lin15] are also known. The transformation of [Dam00] gives a 3-round concurrent zero-knowledge protocol in the CRS model, whereas [Lin15] is non-interactive. In our constructions and protocols, we make use of interactive zero knowledge proofs of knowledge of discrete logarithms and relations between discrete logarithms. We use the following notation: PK{(x, y, ) : statements about x, y, } In the above, x, y, are secrets (discrete logarithms), the prover asserts knowledge of x, y,, and that they satisfy statements. The other values in the protocol are public. 2.6 ZK Proof Based on Garbled Circuits Here, we review an important building block for our construction, i.e., the garbledcircuit-based ZK protocol of [JKO13]. To prove a statement w : R(x, w) = 1 (for public R and x), the protocol proceeds as follows: 1. The verifier generates a garbled circuit computing R(x, ). Using a committing oblivious transfer, the prover obtains the wire labels corresponding to his private input w. Then the verifier sends the garbled circuit to the prover. 2. The prover evaluates the garbled circuit, obtaining a single garbled output (wire label). He commits to this garbled output. 3. The verifier opens his inputs to the committing oblivious transfer, giving the prover all garbled inputs. From this, the prover can check whether the garbled circuit was generated correctly. If so, the prover opens his commitment to the garbled output; if not, the prover aborts. 4. The verifier accepts the proof if the prover s commitment holds the output wire label corresponding to TRUE. Security against a cheating prover follows from the properties of the circuit garbling scheme. Namely, the prover commits to the output wire label before the circuit is opened, so the authenticity property of the garbling scheme ensures that he cannot predict the TRUE output wire label unless he knows a w with R(x, w) = TRUE. Security against a cheating verifier follows from correctness of the garbling scheme. The garbled output of a correctly generated garbled circuit reveals only the output of the (plain) circuit, and this garbled output is not revealed until the garbled circuit was shown to be correctly generated. Note that in this protocol, the prover evaluates the garbled circuit on an input which is completely known to him. This is the main reason that the garbled circuit used for evaluation can also be later opened and checked for correctness, unlike in the setting of cut-and-choose for general 2PC. Along the same lines, it was further pointed out in [FNO15] that the circuit garbling scheme need not satisfy the privacy requirement of

10 [BHR12], only the authenticity requirement. Removing the privacy requirement from the garbling scheme leads to a non-trivial reduction in garbled circuit size. In one of our constructions (section 3.2), the verifier does have a private input, but its input only needs to be kept private until the circuit is evaluated and the prover has committed to the output. In that scenario, we also invoke the privacy property of the garbling scheme as defined above. Efficiency of Garbling Schemes. The state of the art garbling scheme uses the free-xor technique [KS08] to garble XOR gates and the half-gate technique to garble AND gates [ZRE15]. For a circuit with g non-xor gates, the total number of ciphertexts is 2g, and the number of hash invocations is 4g for the garbler and 2g for the evaluator. For privacy-free garbling, the costs are reduced by factor of two (see [FNO15,ZRE15]). In particular, for a circuit with g non-xor gates, the total number of ciphertexts is g, and the number of hash invocations is 2g for the garbler and g for the evaluator. We need to garble a few common building-block circuits in our constructions. It is helpful to review the size of these circuits based on the concrete constructions given in [KSS09]. The circuit for comparing l bit integers requires 4l non-xor gates. The circuit for testing equality of l bit integers also requires 4l non-xor gates. The circuit for adding two l bit integers requires 4l non-xor gates, while the circuit for multiplying two l bit integers requires 8l 2 4l non-xor gates. 3 Proving non-algebraic Statements on Algebraic Commitments An important sub-protocol used in our constructions, is to commit to an input x using an algebraic commitment Com(x) (e.g. pedersen commitment), and perform a zeroknowledge proof of a non-algebraic statement about x, i.e. that f(x) = 1 for a boolean circuit f. Such a protocol allows one to efficiently switch between proving algebraic statements on a committed input (e.g. proof of knowledge of a signature on a committed input) and non-algebraic statement (e.g. hashing, comparison, equality testing and more). All our protocols are defined in terms of an ideal functionality, and are proven secure in the ideal/real world paradigm. We start by defining this task in terms of an ideal functionality in Figure 2. We provide two instantiations for this functionality that provide different efficiency trade-offs depending on the input size and the algebraic commitment scheme used. Fig. 2. The ideal functionality F Com,f The verifier inputs Com(x) and prover inputs the opening information x and the randomness. If f(x) = 1 and the opening to the commitment verifies, output accept to the verifier. The starting point for both instantiations is the ZK-proof of non-algebraic statements based on garbled circuits [JKO13] (see section 2.6). As the naive solution we

11 could garble a circuit that takes x and the opening of Com(x) as prover s input and outputs 1 if f(x) = 1 and Com(x) correctly opens to x. The main drawback of this solution is that checking correctness of opening for an algebraic commitment requires performing expensive group operations (e.g. exponentiation) inside the garbled circuit which would dominate the computation/communication cost. Our two instantiations show how to avoid these costs and perform all algebraic operations outside the garbled circuit. 3.1 First Instantiation In our first construction, we have the prover commit to each bit of x, i.e. Com(x i ) for all i [n], and prove that when combined they yield x. Then, following the GC-based approach, the verifier constructs a garbled circuit that computes f(x), parties go through the steps of the GC-based ZK proof for the prover to prove knowledge of a value x such that f(x ) = 1. The main issue is that a malicious prover may use a different input x x in the circuit than what he committed to. But we observe that the input keys associated with x in the GC (which are obtained through the COT), can function as one-time MACs on each bit of x and can be used to enforce that x = x using efficient algebraic ZK proofs that take place outside the garbled circuit. In particular, immediately after the COTs, the prover commits to its input keys i.e. K x i i for the ith bit of x. When the GC is opened and both input keys Ki 0, K1 i are opened, the prover can provide ZK proofs that Kx i i = x i Ki 1 + (1 x i)ki 0 if the commitment scheme provides efficient proofs of linear relations. The complete protocol description in the COT-hybrid model is given in Figure 3. We point out that steps 1, 6 and 13 are additions compared to the protocol of [JKO13]. Theorem 1. Let G be a garbling scheme satisfying correctness and authenticity properties as defined in 2.4. Let Com be a secure commitment scheme, and let the proofs P K be implemented with a zero knowledge proof of knowledge. Then, the protocol Π Com,f in Figure 3 securely implements F Com,f in the presence of malicious adversaries in the F COT -hybrid model. Proof. Corrupt Prover. The simulator works as follows: It uses the OT simulator to extract the prover s input x to the OT. It then plays the role of the honest verifier in the rest of the simulation - it constructs the garbled circuit honestly and uses its input keys as verifier s inputs to the COT functionality. The simulator then extracts the value Z committed to by the prover from the proofs of knowledge of opening in step 8. It also extracts prover s committed input x and the values K i that prover committed to in the protocol, using the extractor for the ZK proof of knowledge in step 13. The simulator finally outputs x and the opening extracted from the ZK proofs, iff all the following hold: x = x, f(x) = 1, Z is the one-key of the output wire, K i = Kxi i for all i, the commitment in step 8 is opened to Z, and the ZK proofs of step 13 verifies. Note that in the ideal model the functionality will always output accept when the simulator sends this witness. We now prove that a corrupt prover s view in the real protocol is indistinguishable from his view with the simulator via a series of intermediate games.

12 Fig. 3. The Protocol Π Com,f Let G = (Gb, En, De, Eval, Ve) be a verifiable garbling scheme. Let F be the following functionality: it takes as input x, and outputs v such that v = 1 if f(x) = 1 and 0 otherwise. The prover has input x, the verifier is in possession of C x = Com(x) and both parties have as input the security parameter κ. 1. The prover commits to the bits of x by sending bit-wise commitment to x: C i = Com(x i), 1 i n. 2. The verifier constructs a garbled circuit for F. (GC, e, d) Gb(1 κ, F ) 3. The prover inputs his choice bits by sending (i, x i) for all i [n] to F COT. 4. The verifier inputs the wire labels corresponding to the prover s input by sending (i, Ki 0, Ki 1 ) for all i [n] to F COT. 5. F COT outputs K i for all i [n] to the prover where K i = K x i i. 6. The prover commits to the received input wire labels by sending C Ki = Com(K i) for all i. 7. The prover evaluates the garbled circuit Z Eval(GC, {K i} i [n] ) 8. Prover commits to the garbled output Z by sending Com(Z) to the verifier and proves knowledge of opening. 9. Verifier sends open to F COT. 10. F COT sends (K 0 i, K 1 i ) to the prover for all i [n]. 11. Prover verifies that the correct circuit was garbled by running Ve(GC, {K 0 i, K 1 i } i [n] ). If the output is not accept, the prover terminates. Otherwise if Ve outputs accept, he opens the commitment to the output Z by sending Z and the randomness used in Com(Z). 12. Verifier checks that the opening is correct and that De(d, Z) = 1. If the opening is not correct or if De(d, Z) 1, the verifier outputs reject and terminates. 13. If the verifier did not terminate, the prover and the verifier engage in a Zero-knowledge protocol to prove the following: PK{(x i, K i, r, R) : C i = Com(x i) C Ki = Com(K i) K i = x ik 1 i + (1 x i)k 0 i }, 1 i n. PK{(x, x 1,, x n, r, r 1, r n) : C x = Com(x) C i = Com(x i) x = 2 i x i} 14. If the zero-knowledge proof verifies, the verifier outputs accept. Game Ideal: This is the interaction of the corrupt prover with the simulator and functionality as described above. Game G 0 : This is the interaction of the corrupt prover with the simulator as described above, with the exception that instead of the simulator sending x and the opening to F, which outputs accept iff f(x) = 1, the game will output accept iff f(x ) = 1 for the x extracted from the OT (and all the other conditions listed hold). Since one of the conditions checks x = x, this is identical.

13 Game G 1 : This game, behaves exactly as in G 0 except for a slight change in the accept condition. It outputs accept if f(x ) = 1 and K i = Kxi i for all i and Z is the one-key of the output wire and the commitment in step 8 is correctly opened to Z, and all the ZK proofs verify (i.e. no x = x check). Indistinguishability: Define the event Bad as the event that x x, f(x ) = 1, Z is the one-key of the output wire, K i = Kxi i for all i, and the opening to Z is correct and the ZK proofs of step 13 verify. Observe that G 0 is identical to G 1 conditioned on Bad. We now argue that Pr[Bad] is negligible, by observing that an adversary who makes us reject G 0 but accept in G 1, can only succeed with probability 1/2 s where s is a statistical security parameter, given the COT hybrid model. Without loss of generality lets assume the ith bit of x is 0 and ith bit of x is 1. Then, the probability of the adversary guessing Ki 0 given only Ki 1 is less than 1/2 K0 i. Note that Ki 0 is the computational security parameter, which is 128 bits for an AES key. But without loss of security we can used a truncated Ki 0 (to its least significant s bits) in the ZK proofs of step 13. Hence Games G 0 and G 1 are indistinguishable except with negligible probability in s. Game G 2 : This game behaves as in G 1 except for another change in the accept condition. We accept if f(x ) = 1 and ZK proofs of step 13 verifies and Z is the one-key of the output wire, and the commitment in step 8 is correctly opened to Z (i.e. no K i = Kxi i check). If an adversary can distinguish between Games G 1 and G 2, we can break the soundness of the ZK proof of step 13. Therefore, G 1 and G 2 are indistinguishable. Game G 3 : This game behaves as in G 2 except for a small change in accept condition. We accept if ZK proofs of step 13 verifies and Z is the one-key of the output wire, and the commitment in step 8 is correctly opened to Z (i.e. no f(x ) = 1 check). Games G 2 and G 3 are identical, except when the following event occurs: f(x ) 1 and ZK proof of step 13 passes, and Z is the one-key of the output wire. When this event occurs, we accept in G 3 and rejects in G 2. We now argue that the probability of this event is negligible. For the sake of contradiction, assume the prover s input to OT is x such that f(x ) 1, but the value committed to is the correct one-key Z for the output wire. We can use such a prover to break the authenticity of the garbling scheme (See definition 2). Game G 4 : This game behaves as in G 3 except for the accept condition. We accept if the ZK proofs of step 13 verifies and the the commitment in step 8 opens correctly (i.e. no check that it is the same as extracted Z). An adversary who can distinguish between G 3 and G 4 can be used to violate the binding property of the commitment scheme. G 4 is identical to the real world game with an honest verifier. Corrupt Verifier. The simulator commits to bits of a random value. It also uses a random value as prover s inputs to the COT, and receives the verifier s inputs to the COT functionality (Ki 0, K1 i ) for all i, i.e. the input keys to the verifier GC. The simulator then commits to the keys corresponding to the random input it used in the OTs.

14 It then runs Ve(GC, (Ki 0, K1 i ), f) to either obtain reject, or the decoding information d. If the output is reject it commits to a dummy value, else it commits to the one-key for the output wire, denoted by Z. It then receives the open message from the verifier. If Ve had not output reject earlier, the simulator opens the commitment to Z and uses the simulator for the ZK proof to simulate the proofs of step 13. Otherwise, the simulator aborts. Game G 0 : This is the interaction of the corrupt verifier with the simulator as described above. Game G 1 : Is similar to game G 0 except that the real input x of prover is committed to. The two games are indistinguishable due to the hiding property of the commitment scheme. Game G 2 : Is similar to G 1 except that instead of computing Z by running Ve, we run Eval(GC, K xi i ) to compute and commit to Z. The two games are indistinguishable due to the second condition in the correctness property of the garbling scheme. Note that we are also implicitly using the committing OT property (the protocol described in the COT hybrid model) as the keys extracted in the OTs and what the functionality sends to the honest prover are the same. Game G 3 : Is similar to G 2 except that the honest input x of the prover is used in the OTs. The two games are identical in the OT hybrid model. Game G 4 : Is similar to G 3 except that the simulator commits to inputs keys associated with the real input x. The two games are identical due to the hiding property of the commitment scheme. Game G 5 : Is similar to G 4 except that in step 13, the simulator performs the proofs, honestly. The two games are indistinguishable due to zero-knowledge property of the ZK proof. Note that G 5 is the real game with the honest prover. 3.2 Second Instantiation We now give an alternative construction that implements the functionality in Figure 2. In particular, we avoid the bit-wise commitments to each bit of x i, and the associated bit-wise ZK proofs, and hence require fewer public-key operations (exponentiations) in the construction. On the other hand, the garbled circuit is augmented and hence a larger number of symmetric-key operations are needed. The idea is as follows. In order to ensure that the prover uses the same input x in the GC, we have the circuit not only compute f(x) but also a one-time MAC of x, i.e. t = ax + b for random a and b of the verifier s choice. a and b are initially unknown to the prover, but are opened along with the GC after the prover has committed to t. Given a and b, the prover then provides a ZK proof that Com(t) is indeed the one-time MAC of x (using efficient proofs of linear relations). We note that the t = ax + b operation performed in the circuit is on integers.

15 We note that our construction deviates from the standard construction of GC-based ZK where the verifier has no input, and privacy-free garbling is sufficient. In particular, we do invoke the privacy property of the garbling scheme in our construction to ensure that the prover does not learn a and b, until the opening stage. The complete protocol description in the COT-hybrid model is given in Figure 4. Theorem 2. Let G be a garbling scheme satisfying correctness, authenticity, and privacy properties as defined in section 2.4. Let Com be a secure commitment scheme, and let the proofs P K be implemented with a zero knowledge proof of knowledge. Then, the protocol Π MAC,f in figure 4 securely implements F Com,f in the presence of malicious adversaries in the F COT -hybrid model. Proof. Corrupt Prover. The simulator works as follows: It uses the OT simulator to extract the prover s input x to the OT. It then plays the role of the honest verifier in the rest of the simulation - it chooses a, b randomly as the honest verifier would, constructs the garbled circuit honestly and uses its input keys as verifier s inputs to the COT functionality. The simulator then extracts the value Z committed to by the prover from the proofs of knowledge of opening in step 8. It also extracts prover s committed input x and the tag t that the prover committed to in the protocol, using the extractor for the ZK proof of knowledge in step 16. The simulator finally outputs x and the opening extracted from the ZK proofs, iff all the following hold: x = x, f(x) = 1, Z is the one-key of the output wire, t = ax + b, the commitment in step 8 is opened to Z, and the ZK proof of step 16 verifies. Note that in the ideal model the functionality will always output accept when the simulator sends this witness. We now prove that a corrupt prover s view in the real protocol is indistinguishable from his view with the simulator by a series of intermediate games. Game Ideal: This is the interaction of the corrupt prover with the simulator and functionality as described above. Game G 0 : This is the interaction of the corrupt prover with the simulator as described above, with the exception that instead of the simulator sending x and the opening to F, which outputs accept iff f(x)=1, the game will output accept iff f(x ) = 1 for the x extracted from the OT (and all the other conditions listed hold). Since one of the conditions checks x = x, this is identical. Game G 1 : In this game, the simulator behaves exactly as in G 0 except that it does not check the x = x condition. Define the event Bad as the event that x x but t = ax + b. Observe that G 0 is identical to G 1 conditioned on Bad. We argue that Pr[Bad] is negligible due to the unforgeability property of the one-time MAC, the hiding property of the commitment scheme, and the privacy of the garbled circuit. Consider a game where we run as in G 1 but stop after step 10, and look at the probability that in this gane t = ax + b but x x ; if Pr[Bad] is nonnegligible, this will be nonnegligible as well. Now, by the privacy of the garbled circuit, this is indistinguishable from a game where the verifier computes a tag t on x, and then constructs (GC, e, d) using the privacy simulator: S(F, (t, 1)). Similarly, by the hiding of the commitment scheme this is still indistinguishable from a game where

16 the verifier commits to random values instead of a, b. But if in this final game we get t = ax + b and x x with non-negligible probability, then we can break the unforgeability of the MAC. The probability of forgery is bounded by 1/2 a, and hence exponentially small in the statistical security parameter s = a. Game G 2 : In this game, the simulator behaves as in G 1 except that it does not check the condition t = ax + b. If an adversary can distinguish between Games G 2 and G 1, we can break the soundness of the ZK proof of step 16. Game G 3 : In this game, the simulator behaves as in G 2 except that we do not check the condition f(x ) = 1. Games G 2 and G 3 are identical, except when the following event occurs: f(x ) 1 and ZK proof of tag verifies and Z is the one-key of the output wire. We now argue that the probability of this event is negligible. For the sake of contradiction, assume the prover s input to OT is x such that f(x ) 1, but the value committed to is the correct one-key Z for the output wire. We can use such a prover to break the authenticity of the garbling scheme (See definition 2). Game G 4 : In this game, the simulator behaves as in G 3 except for the accept condition. The simulator accepts if the ZK proofs of step 16 verifies and the commitment in step 8 opens correctly (i.e. no check that it is the same as extracted Z). An adversary who can distinguish between G 4 and G 3 can be used to violate the binding property of the commitment scheme. G 4 is identical to the real world game with an honest verifier. Corrupt Verifier. The simulator extracts a and b from the proofs of knowledge of their openings by verifier. It uses a random value as prover s inputs to the COT, and receives the verifier s inputs to the COT functionality (Ki 0, K1 i ) for all i, i.e. the input keys to the verifier GC. It then runs Ve(GC, (Ki 0, K1 i ), F ) (and checks against the extracted a, b) to either obtain reject, or the decoding information d. If the output is reject it commits to dummy values for Z and t, else it commits to the one-key for the output wire denoted by Z, and dummy t. The simulator receives the openings of Com(a) and Com(b). If the openings are not what it extracted earlier, or if Ve had output reject earlier, it aborts. Else, the simulator opens the commitment to Z and uses the simulator for the ZK proof to simulate the proofs of step 16. Game G 0 : This is the interaction of the corrupt verifier with the simulator as described above. Game G 1 : Is similar to game G 0 except that t = ax+b for the real input x of prover is committed to. The two games are indistinguishable due to the hiding property of the commitment scheme. Game G 2 : Is similar to G 1 except that instead of computing Z and t by running Ve, we run Eval(GC, K xi i ) to compute and commit to Z and t. The two games are indistinguishable due to the second condition in the correctness property of the garbling scheme, and binding property of commitments Com(a)

17 and Com(b). Note that we are also implicitly using the committing OT property (the protocol described in the COT hybrid model) as the keys extracted in the OTs and what the functionality sends to the honest prover are the same. Game G 3 : Is similar to G 2 except that the honest input x of the prover is used in the OTs. The two games are identical in the OT hybrid model. Game G 4 : Is similar to G 3 except that in step 13, the simulator performs the proofs honestly. The two games are indistinguishable due to zero-knowledge property of the ZK proof. Note that G 4 is the real game with the honest prover. 3.3 Efficiency Comparison and Optimizations Efficiency Comparison In our first instantiation, in addition to the cost associated with the GC-based ZK, i.e. the oblivious transfer for x and the cost of garbling f, O(n) exponentiations are necessary to commit to each bit of input x and to perform the bitwise ZK proofs associated with them in the last step. In our second instantiation, the bitwise commitments/proofs are eliminated (i.e. only a constant number of exponentiations) but instead the circuit for ax + b needs to be garbled which requires O(ns + s 2 ) additional symmetric-key operations when using textbook multiplication (we discuss range of values for s shortly). Using Karatsuba s multiplication algorithm [Knu69], this can potentially be further reduced. The round complexity of both protocols is essentially the same as the GC-based ZK proof of [JKO13] (5 rounds), as the extra messages can be sent within the same rounds. (To simplify presentation, we used a separate step for each operation in our protocol description, but many of these can be combined.) A more round-efficient GC-based ZK proof would make our constructions more round efficient as well. The first instantiation requires more exponentiations which are significantly costlier than their symmetric-key counterpart, but the total number of symmetric-key operations in the second instantiation is higher. Hence, when n is small, the first instantiation is likely more efficient, while when n is larger, the second instantiation will be the better option. Furthermore, if bit-wise commitment to the input is already necessary as part of the bigger protocol (as is the case in some of our constructions), the first instantiation may be the better choice. In the case where a comparison circuit x < q is also computed, an additional O(n) symmetric-key operations suffices. Optimizations Next we review a few other optimizations that improve efficiency of our instantiations. Reducing exponentiations. We consider the following optimization for the protocol Π Com,f in Fig. 3 which reduces the number of exponentiations necessary for the ZK proofs significantly. In step 6, the prover commits to the sum of the keys received instead of individually to each wire key. The prover sends Com(S) = Com ( n i=1 K i ) in step 6. We assume that the bit commitment scheme Com is homomorphic, and each wire key K i is truncated to s bits and interpreted as a group